CVE-2020-28390

A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3). The application contains an information leakage vulnerability in the handling of web client sessions. A local attacker who has access to the Web Client Session Storage could disclose the passwords of currently logged-in users.

CVSS v3 5.5 MEDIUM
CVSS v2.0 2.1 LOW

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf	Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-051/	Not Applicable
https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf	Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-051/	Not Applicable

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:siemens:opcenter_execution_core:8.2:::::::*
	cpe:2.3:a:siemens:opcenter_execution_core:8.3:::::::*

History

No history.

Information

Published : 2021-01-12 21:15

Updated : 2024-11-21 05:22

NVD link : CVE-2020-28390

Mitre link : CVE-2020-28390

CVE.ORG link : CVE-2020-28390

JSON object : View

Products Affected

siemens

opcenter_execution_core

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2020-28390", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2021-01-12T21:15:18.043", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-051/", "tags": ["Not Applicable"], "source": "productcert@siemens.com"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-051/", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-522"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3). The application contains an information leakage vulnerability in the handling of web client sessions. A local attacker who has access to the Web Client Session Storage could disclose the passwords of currently logged-in users."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en Opcenter Execution Core (versi\u00f3n V8.2), Opcenter Execution Core (versi\u00f3n V8.3). La aplicaci\u00f3n contiene una vulnerabilidad de filtrado de informaci\u00f3n en el manejo de sesiones de cliente web. Un atacante local que tenga acceso al almacenamiento de sesi\u00f3n del cliente web podr\u00eda revelar las contrase\u00f1as de los usuarios que han iniciado sesi\u00f3n actualmente"}], "lastModified": "2024-11-21T05:22:42.313", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:opcenter_execution_core:8.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19CF8C8B-5478-45C3-969F-9B3FD516F1FF"}, {"criteria": "cpe:2.3:a:siemens:opcenter_execution_core:8.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "448F0FD8-736E-4432-8520-5516D86C768D"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}